Abnormality detection device, abnormality detection method, and program

Abstract

An abnormality detection device includes a processor and a storage unit connected to the processor. The processor is configured to execute an error vector acquisition process of acquiring an error vector representing a difference between a measurement value vector having multiple measurement values measured at a determination time as elements and an average value vector having an average value of the measurement values accumulated in the storage unit as an element, a component acquisition process of acquiring a plurality of components into which the error vector is decomposed with respect to a direction of a singular vector, a comparing process of comparing a value obtained by squaring each of the components into which the error vector is decomposed with respect to the direction of the singular vector with corresponding variance in the direction of the singular vector individually with respect to the direction of the singular vector, and a determination process of performing an abnormality determination on the basis of plural compared results in the comparing process.

What is claimed is: 
     
       1. An abnormality detection device that is configured to detect presence or absence of an abnormality in a target device, the abnormality detection device comprising:
 a processor; 
 a transceiver that receives, from the target device, measurement values related to the target device, wherein the measurement values are measured by the target device at a determination time; 
 a storage unit connected to the processor and the transceiver and that stores:
 the measurement values; and 
 accumulated measurement values in which the measurement values have been accumulated; and 
 
 a bus that connects the processor, the storage unit, and the transceiver, wherein 
 the processor is configured to execute:
 an error vector acquisition process of acquiring an error vector representing a difference between a measurement value vector having the measurement values measured at the determination time as elements and an average value vector having an average value of the accumulated measurement values as an element; 
 a component acquisition process of acquiring a plurality of components into which the error vector is decomposed with respect to a direction of a singular vector; 
 a comparing process of comparing a value obtained by squaring each of the components into which the error vector is decomposed with respect to the direction of the singular vector with corresponding variance in the direction of the singular vector individually with respect to the direction of the singular vector; and 
 a determination process of determining the presence or absence of an abnormality on the basis of a plurality of compared results in the comparing process, and 
 
 upon determining the presence of the abnormality, the processor causes the transceiver to transmit, to a control device that controls the target device, a notification indicating the presence of abnormality. 
 
     
     
       2. The abnormality detection device according to  claim 1 , wherein,
 in the comparing process, the processor is configured to output the compared result indicating whether a difference between a value obtained by squaring each of the component into which the error vector is decomposed with respect to the direction of the singular vector and corresponding variance in the direction of the singular vector is equal to or greater than a predetermined threshold, and 
 in the determination process, the processor is configured to determine an abnormality in a case where the number of compared results indicating that the difference is equal to or greater than the threshold is equal to or greater a predetermined upper-limit number. 
 
     
     
       3. The abnormality detection device according to  claim 1 , wherein
 the processor is further configured to execute a frequency distribution calculation process of obtaining a percentile value corresponding to each of the components acquired at the determination time on the basis of a frequency distribution obtained from components into which the error vector is decomposed with respect to the direction of the singular vector and which are accumulated in the storage unit, and 
 in the comparing process, the processor is configured to correct the variance on the basis of the percentile value. 
 
     
     
       4. The abnormality detection device according to  claim 1 , wherein the processor is further configured to execute
 a frequency distribution calculation process of obtaining a frequency of occurrence corresponding to each of the components acquired at the determination time on the basis of a frequency distribution obtained from components into which the error vector is decomposed with respect to the direction of the singular vector and which are accumulated in the storage unit, and 
 a normalization process of obtaining a probability density in which the component acquired at the determination time is observed on the basis of the frequency of occurrence and a probability distribution obtained by normalizing the frequency distribution, and 
 in the comparing process, the processor is configured to correct the variance on the basis of the probability density. 
 
     
     
       5. The abnormality detection device according to  claim 1 , wherein the measurement value vector includes a first measurement value vector having the measurement values measured at the determination time as elements and a second measurement value vector having measurement values measured before the determination time as elements. 
     
     
       6. The abnormality detection device according to  claim 5 , wherein the second measurement value vector has fewer kinds of measurement values than the first measurement value vector as elements. 
     
     
       7. The abnormality detection device according to  claim 1 , wherein
 the target device is configured of a plurality of devices of the same type, and 
 in the error vector acquisition process, the processor is configured to acquire, as the error vector, a vector representing a difference between a measurement value vector with respect to the target device having measurement values measured in each of a plurality of the target devices as elements and an average value vector with respect to the target device accumulated in the storage unit. 
 
     
     
       8. An abnormality detection device that is configured to detect presence or absence of an abnormality in a target device, the abnormality detection device comprising:
 a processor; 
 a transceiver that receives, from the target device, measurement values related to the target device, wherein the measurement values are measured by the target device at a determination time; 
 a storage unit connected to the processor and the transceiver and that stores:
 the measurement values; and 
 accumulated measurement values in which the measurement values have been accumulated; and 
 
 a bus that connects the processor, the storage unit, and the transceiver, wherein 
 the processor is configured to execute:
 an error vector acquisition process of acquiring an error vector representing a difference between a measurement value vector having the measurement values measured at the determination time as elements and an average value vector having an average value of the accumulated measurement values as an element; 
 a component acquisition process of acquiring a component vector having components into which the error vector is decomposed with respect to a direction of a singular vector as elements; 
 a Mahalanobis distance calculation process of calculating a Mahalanobis distance on the basis of the component vector, variance in the direction of the singular vector, and a correction coefficient with respect to the direction of the singular vector; and 
 a determination process of determining the presence or absence of an abnormality on the basis of the Mahalanobis distance, and 
 
 upon determining the presence of the abnormality, the processor causes the transceiver to transmit, to a control device that controls the target device, a notification indicating the presence of abnormality. 
 
     
     
       9. The abnormality detection device according to  claim 8 , wherein the processor is further configured to execute a frequency distribution calculation process of obtaining a percentile value corresponding to each of the components acquired at the determination time on the basis of a frequency distribution obtained from components into which the error vector is decomposed with respect to the direction of the singular vector and which are accumulated in the storage unit, and
 in the Mahalanobis distance calculation process, the processor is configured to correct the correction coefficient on the basis of the percentile value. 
 
     
     
       10. The abnormality detection device according to  claim 8 , wherein the processor is further configured to execute
 a frequency distribution calculation process of obtaining a frequency of occurrence corresponding to each of the components acquired at the determination time on the basis of a frequency distribution obtained from components into which the error vector is decomposed with respect to the direction of the singular vector and which are accumulated in the storage unit, and 
 a normalization process of obtaining a probability density in which the component acquired at the determination time is observed on the basis of the frequency of occurrence and a probability distribution obtained by normalizing the frequency distribution, and 
 in the Mahalanobis distance calculation process, the processor is configured to correct the correction coefficient on the basis of the probability density. 
 
     
     
       11. An abnormality detection method comprising:
 receiving, with a transceiver of a computer, from a target device, measurement values related to the target device, wherein the measurement values are measured by the target device at a determination time; 
 storing, in a storage of the computer, the measurement values; 
 storing, in the storage, accumulated measurement values in which the measurement values have been accumulated; 
 acquiring, with a processor of the computer, an error vector representing a difference between a measurement value vector having the measurement values measured at the determination time as elements and an average value vector having an average value of the accumulated measurement values as an element; 
 acquiring, with the processor, a plurality of components into which the error vector is decomposed with respect to a direction of a singular vector; 
 comparing, with the processor, a value obtained by squaring each of the components into which the error vector is decomposed with respect to the direction of the singular vector with corresponding variance in the direction of the singular vector individually with respect to the direction of the singular vector; 
 determining presence or absence of an abnormality on the basis of a plurality of compared results; and 
 upon determining the presence of the abnormality, transmitting, from the transceiver to a control device that controls the target device, a notification indicating the presence of abnormality. 
 
     
     
       12. An abnormality detection method comprising:
 receiving, with a transceiver of a computer, from a target device, measurement values related to the target device, wherein the measurement values are measured by the target device at a determination time; 
 storing, in a storage of the computer, the measurement values; 
 storing, in the storage, accumulated measurement values in which the measurement values have been accumulated; 
 acquiring, with a processor of the computer, an error vector representing a difference between a measurement value vector having the measurement values measured at the determination time as elements and an average value vector having an average value of the accumulated measurement values as an element; 
 acquiring, with the processor, a component vector having components into which the error vector is decomposed with respect to a direction of a singular vector as elements; 
 calculating, with the processor, a Mahalanobis distance on the basis of the component vector, variance in the direction of the singular vector, and a correction coefficient with respect to the direction of the singular vector; 
 determining, with the processor, presence or absence of an abnormality on the basis of the Mahalanobis distance; and 
 upon determining the presence of the abnormality, transmitting, from the transceiver to a control device that controls the target device, a notification indicating the presence of abnormality. 
 
     
     
       13. A non-transitory computer readable medium storing a program for causing a computer of an abnormality detection device including a processor, a transceiver, and a storage unit connected to the processor and the transceiver to function, the program causing the processor to:
 cause the transceiver to receive, from a target device, measurement values related to the target device, wherein the measurement values are measured by the target device at a determination time; 
 cause the storage unit to store the measurement values; 
 cause the storage unit to store accumulated measurement values in which the measurement values have been accumulated; 
 acquire an error vector representing a difference between a measurement value vector having the measurement values measured at the determination time as elements and an average value vector having an average value of the accumulated measurement values as an element; 
 acquire a plurality of components into which the error vector is decomposed with respect to a direction of a singular vector; 
 compare a value obtained by squaring each of the components into which the error vector is decomposed with respect to the direction of the singular vector with corresponding variance in the direction of the singular vector individually with respect to the direction of the singular vector; 
 determine presence or absence of an abnormality on the basis of a plurality of compared results; and 
 upon determining the presence of the abnormality, cause the transceiver to transmit, to a control device that controls the target device, a notification indicating the presence of abnormality. 
 
     
     
       14. A non-transitory computer readable medium storing a program for causing a computer of an abnormality detection device including a processor, a transceiver, and a storage unit connected to the processor and the transceiver to function, the program causing the processor to:
 cause the transceiver to receive, from a target device, measurement values related to the target device, wherein the measurement values are measured by the target device at a determination time; 
 cause the storage unit to store the measurement values; 
 cause the storage unit to store accumulated measurement values in which the measurement values have been accumulated; 
 acquire an error vector representing a difference between a measurement value vector having the measurement values measured at the determination time as elements and an average value vector having an average value of the accumulated measurement values as an element; 
 acquire a component vector having components into which the error vector is decomposed with respect to a direction of a singular vector as elements; 
 calculate a Mahalanobis distance on the basis of the component vector, variance in the direction of the singular vector, and a correction coefficient with respect to the direction of the singular vector; 
 determine presence or absence of an abnormality on the basis of the Mahalanobis distance; and 
 upon determining the presence of the abnormality, cause the transceiver to transmit, to a control device that controls the target device, a notification indicating the presence of abnormality.